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The Fuchs-Peres-Brandt (FPB) probe realizes the most powerful individual attack on Bennett- 
Brassard 1984 quantum key distribution (BB84 QKD) by means of a single controUed-NOT (CNOT) 
gate. This paper describes a complete physical simulation of the FPB-probe attack on polarization- 
based BB84 QKD using a deterministic CNOT constructed from single-photon two-qubit quantum 
logic. Adding polarization-preserving quantum nondemolition measurements of photon number to 
this configuration converts the physical simulation into a true deterministic realization of the FPB 
attack. 
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I. INTRODUCTION 

Bennett-Brassard 1984 quantum key distribution 
(BB84 QKD) using single-photon polarization states 
works as follows 0. In each time interval allotted for 
a bit, Alice transmits a single photon in a randomly se- 
lected polarization, chosen from horizontal {H), vertical 
{V), -1-45°, or —45°, while Bob randomly chooses to de- 
tect photons in either the H /V or ±45° bases. Bob dis- 
closes to Alice the sequence of bit intervals and associated 
measurement bases for which he has detections. Alice 
then informs Bob which detections occurred in bases co- 
incident with the ones that she used. These are the sift 
events, i.e., bit intervals in which Bob has a detection and 
his count has occurred in the same basis that Alice used. 
An error event is a sift event in which Bob decodes the 
incorrect bit value. Alice and Bob employ a prescribed 
set of operations to identify errors in their sifted bits, 
correct these errors, and apply sufficient privacy ampli- 
fication to deny useful key information to any potential 
eavesdropper (Eve). At the end of the full QKD pro- 
cedure, Alice and Bob have a shared one-time pad with 
which they can communicate in complete security. 

In long-distance QKD systems, most of Alice's pho- 
tons will go undetected, owing to propagation loss and 
detector inefficiencies. Dark counts and, for atmospheric 
QKD systems, background counts can cause error events 
in these systems, as can intrusion by Eve. Employing 
an attenuated laser source, in lieu of a true single-photon 
source, further reduces QKD performance as such sources 
are typically run at less than one photon on average per 
bit interval, and the occurrence of multi-photon events, 
although rare at low average photon number, opens up 
additional vulnerability. Security proofs have been pub- 
lished for ideal BB84 as have security analyses that 
incorporate a variety of non- idealities Q . Our attention, 
however, will be directed toward attacking BB84 QKD, 
as to our knowledge no such experiments have been per- 
formed, although a variety of potentially practical ap- 
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proaches have been discussed jj]. Our particular objec- 
tive will be to show that current technology permits phys- 
ical simulation of the Fuchs-Peres-Brandt (FPB) probe 
Isl, i.e., the most powerful individual attack on single- 
photon BB84, and that developments underway in quan- 
tum nondemolition (QND) detection may soon turn this 
physical simulation into a full implementation of the at- 
tack. Thus we believe it is of interest to construct the 
physical simulation and put BB84's security to the test: 
how much information can Eve really derive about the 
key that Alice and Bob have distilled while keeping Alice 
and Bob oblivious to her presence. 

The remainder of this paper is organized as follows. 
In Sec. II we review the FPB probe and its theoret- 
ical performance. In Sec. Ill we describe a complete 
physical simulation of this probe constructed from single- 
photon two-qubit (SPTQ) quantum logic. We conclude, 
in Sec. IV, by showing how the addition of polarization- 
preserving QND measurements of photon number can 
convert this physical simulation into a true determinis- 
tic realization of the FPB attack on polarization-based 
BB84. 



II. THE FUCHS-PERES-BRANDT PROBE 

In an individual attack on single-photon BB84 QKD, 
Eve probes Alice's photons one at a time. In a collective 
attack. Eve's measurements probe groups of Alice's pho- 
tons. Less is known about collective attacks 6j, so we 
will limit our consideration to individual attacks. Fuchs 
and Peres described the most general way in which 
an individual attack could be performed. Eve supplies a 
probe photon and lets it interact with Alice's photon in a 
unitary manner. Eve then sends Alice's photon to Bob, 
and performs a probability operator- valued measurement 
(POVM) on the probe photon she has retained. Slutsky 
et al. demonstrated that the Fuchs-Peres construct — 
with the appropriate choice of probe state, interaction, 
and measurement — affords Eve the maximum amount of 
Renyi information about the error-free sifted bits that 
Bob receives for a given level of disturbance, i.e., for a 
given probability that a sifted bit will be received in er- 
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ror. Brandt extended the Slutsky et al. treatment by 
showing that the optimal probe could be realized with a 
single CNOT gate. Figure 1 shows an abstract diagram of 
the resulting Fuchs-Peres-Brandt probe. In what follows 
we give a brief review of its structure and performance — 
see |a] for a more detailed treatment — where, for simplic- 
ity, we assume ideal conditions in which Alice transmits 
a single photon per bit interval, there is no propagation 
loss and no extraneous (background) light collection, and 
both Eve and Bob have unity quantum efficiency pho- 
todetectors with no dark counts. These ideal conditions 
imply there will not be any errors on sifted bits in the 
absence of eavesdropping; the case of more realistic con- 
ditions will be discussed briefly in Sec. IV. 
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FIG. 1: (Color online) Block diagram of the Fuchs-Peres- 
Brandt probe for attacking BB84 QKD. 

In each bit interval Alice transmits, at random, a single 
photon in one of the four BB84 polarization states. Eve 
uses this photon as the control-qubit input to a CNOT 
gate whose computational basis — relative to the BB84 
polarization states — is shown in Fig. 2, namely 

|0) = cos(7r/8)|iJ) +sin(7r/8)|y) (1) 
|1) = -sin(7r/8)|i7) +cos(7r/8)|F), (2) 

in terms of the H/V basis. Eve supplies her own probe 
photon, as the target-qubit input to this CNOT gate, in 
the state 

|ri„>^C|+> + 5|-), (3) 

where C = VI - "^Pe, S = l±) = (|0) ± |l))/\/2, 

and < Pe < 1/2 will turn out to be the error prob- 
ability that Eve's probe creates on Bob's sifted bits 0. 
So, as Pe increases from to 1/2, jTin) goes from |-|-) to 
|— ). The (unnormalized) output states that may occur 
for this target qubit are 
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FIG. 2: (Color online) Computational basis for Eve's CNOT 
gate referenced to the BB84 polarization states. 



CNOT's input and the kets on the right-hand side de- 
note the Bob (8) Eve state of the control and target qubits 
at the CNOT's output. Similarly, when Alice uses the 
±45° basis. Eve's CNOT gate has the following behav- 
ior, 



1+45°) |Ti„ 
|-45°)|ri. 



-45°)|T+) + |-45°)|Tb) (8) 
-45°)|T_) + |+45°)|r£). (9) 



Suppose that Bob measures in the basis that Alice has 
employed and his outcome matches what Alice sent. 
Then Eve can learn their shared bit value, once Bob dis- 
closes his measurement basis, by distinguishing between 
the |T+) and |T_) output states for her target qubit. Of 
course, this knowledge comes at a cost: Eve has caused 
an error event whenever Alice and Bob choose a com- 
mon basis and her target qubit's output state is \Te). 
To maximize the information she derives from this intru- 
sion. Eve applies the minimum error probability receiver 
for distinguishing between the single-photon polarization 
states |T_|_) and |T_). This is a projective measurement 
onto the polarization basis {|d-|-), |(i_)}, shown in Fig. 3 
and given by 



\d+) = 
\d) = 



\+) + \-) 
V2 



V2 



= 1 



(10) 
(11) 




Here is how the FPB probe works. When Alice uses 
the H/V basis for her photon transmission. Eve's CNOT 
gate effects the following transformation, 

|i/)|Ti„) ^ \H)\T^) + \V)\Te) (6) 
\Vm^) ^ \V)\T+) + \H)\Te), (7) 

where the kets on the left-hand side denote the Al- 
ice® Eve state of the control and target qubits at the 



FIG. 3: (Color online) Measurement basis for Eve's minimum- 
error-probability discrimination between |r+) and IT-). 

Two straightforward calculations will now complete 
our review of the FPB probe. First, we find the error 
probability that is created by Eve's presence. Suppose 
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Alice and Bob use the H/V basis and Alice has sent \H). 
Alice and Bob will incur an error if the control target 
output from Eve's CNOT gate is \V)\Te). The proba- 
bility that this occurs is {Te\Te) = S"^ /2 = Pe- The 
same conditional error probability ensues for the other 
three error events, e.g., when Alice and Bob use the 
±45° basis, Alice sends |-l-45°), and the CNOT output is 
|— 45°)|Te). It follows that the unconditional error prob- 
ability incurred by Alice and Bob on their sift events is 
Pe- 

Now we shall determine the Renyi information that 
Eve derives about the sift events for which Alice and 
Bob do not suffer errors. Let B = {0, 1} and E = {0, 1} 
denote the ensembles of possible bit values that Bob and 
Eve receive on a sift event in which Bob's bit value agrees 
with Alice's. The Renyi information (in bits) that Eve 
learns about each Alice/Bob error- free sift event is 




FIG. 4: (Color online) Eve's Renyi information about Bob's 
error-free sifted bits as a function of the error probability that 
her eavesdropping creates. 



+ ^P(e)logJ^p2(^| (^2) 

e=0 \b=0 / 

where {P(6),P(e)} are the prior probabilities for Bob's 
and Eve's bit values, and P{b \ e) is the conditional prob- 
ability for Bob's bit value to be h given that Eve's is e. 
Alice's bits are equally likely to be or 1, and Eve's 
conditional error probabilities satisfy [Til l 



P(e = 1 I 6 = 0) = P(e = I 6 = 1) 



1/ _ L |(T+|r_)p 
2 1 V (r+|r+)(T_|T_) 
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(13) 
(14) 
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These results imply that b is also equally likely to be 
or 1, and that P{b \ e) = P{e \ b), whence 



Ib. = log2 1 



4Pg(l-2Pg) \ 



(16) 



which we have plotted in Fig. 4. 

Figure 4 reveals several noteworthy performance points 
for the FPB probe. The Ir = 0, Pb = point in this 
figure corresponds to Eve's operating her CNOT gate 
with |Tin) = 1+) for its target qubit input. It is well 
known that such an input is unaffected by and does not 
affect the control qubit. Thus Bob suffers no errors but 
Eve gets no Renyi information. The Ir = 1,Pe = 1/3 
point in this figure corresponds to Eve's operating her 
CNOT gate with |Tin) = 0731+) + ^2731-), which 
leads to \T±) oc \d±). In this case Eve's Fig. 3 receiver 
makes no errors, so she obtains the maximum (1 bit) 
Renyi information about each of Bob's error-free bits. 
The Ir — 0, Pe = 1/2 point in this figure corresponds to 
Eve's operating her CNOT gate with jTin) = |— ), which 



gives |r+) 



= \Te) = ^/l/2\-). Here it is clear 
that Eve gains no information about Bob's error-free bits, 
but his error probability is 1/2 because of the action of 
the |— ) target qubit on the control qubit. 



III. PHYSICAL SIMULATION IN SPTQ LOGIC 

In single-photon two-qubit quantum logic, each pho- 
ton encodes two independently controllable qubits [ll|. 
One of these is the familiar polarization qubit, with ba- 
sis {\II), \ V)}. The other we shall term the momentum 
qubit — because our physical simulation of the FPB probe 
will rely on the polarization-momentum hyperentangled 
photon pairs produced by type-II phase matched spon- 
taneous parametric downconversion (SPDC) — although 
in the coUimated configuration in which SPTQ is im- 
plemented its basis states are single-photon kets for 
right and left beam positions (spatial modes), denoted 
{|P),|L)}. Unlike the gates proposed for linear optics 
quantum computing |l2|. which are scalable but non- 
deterministic, SPTQ quantum logic is deterministic but 
not scalable. Nevertheless, SPTQ quantum logic suffices 
for a complete physical simulation of polarization-based 
BB84 being attacked with the FPB probe, as we shall 
show. Before doing so, however, we need to comment on 
the gates that have been demonstrated in SPTQ logic. 

It is well known that single qubit rotations and CNOT 
gates form a universal set for quantum computation. In 
SPTQ quantum logic, polarization-qubit rotations are 
easily accomplished with wave plates, just as is done 
in linear optics quantum computing. Momentum-qubit 
rotations are realized by first performing a SWAP op- 
eration, to exchange the polarization and momentum 
qubits, then rotating the polarization qubit, and finally 
performing another SWAP. The SWAP operation is a 
cascade of three CNOTs, as shown in Fig. 5. For its im- 
plementation in SPTQ quantum logic the left and right 
CNOTs in Fig. 5 are momentum-controlled NOT gates 
(M-CNOTs) and the middle CNOT is a polarization- 
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controlled NOT gate (P-CNOT). (An M-CNOT uses 
the momentum qubit of a single photon to perform the 
controlled-NOT operation on the polarization qubit of 
that same photon, and vice versa for the P-CNOT gate.) 
Experimental demonstrations of deterministic M-CNOT, 
P-CNOT, and SWAP gates are reported in [Hill. 




this manner. Moreover, if Eve could do so, she would not 
bother with an FPB probe as she could directly observe 
Bob's bit values. 



one of 
four pol. states 



pol. state 
unchanged 



Single 
photon 
source 



0D 







impose 
— momentum 


— 1 P-CNOT |- 


qubit 





I SWAP I y I SWAP I 
HWP 



Bob's pol. 
analysis 



FIG. 5: Quantum circuit diagram for a SWAP gate realized 
as a cascade of three CNOTs. In SPTQ quantum logic the 
upper rail is the momentum qubit and the lower rail is the 
polarization qubit of the same photon. 

Figure 6 shows a physical simulation of polarization- 
based BB84 under FPB attack when Alice has a single- 
photon source and Bob employs active basis selection; 
Fig. 7 shows the modification needed to accommodate 
Bob's using passive basis selection. In either case, Alice 
uses a polarizing beam splitter and an electro-optic mod- 
ulator, as a controllable half-wave plate (HWP), to set 
the randomly-selected BB84 polarization state for each 
photon she transmits. Moreover, she employs a single 
spatial mode, which we assume coincides with the i? 
beam position in Eve's apparatus. Eve then begins her 
attack by imposing the probe state iTin) on the momen- 
tum qubit. She does this by applying a SWAP gate, 
to exchange the momentum and polarization qubits of 
Alice's photon, rotating the resulting polarization qubit 
(with the HWP in Fig. 6) to the |Ti„) state, and then 
using another SWAP to switch this state into the mo- 
mentum qubit. This procedure leaves Alice's BB84 po- 
larization state unaffected, although her photon, which 
will ultimately propagate on to Bob, is no longer in a sin- 
gle spatial mode. Eve completes the first stage of her at- 
tack by sending Alice's photon through a P-CNOT gate, 
which will accomplish the state transformations given in 
Eqs. ©-(PI), and then routing it to Bob. If Bob em- 
ploys active basis selection (Fig. 6), then in each bit in- 
terval he will use an electro-optic modulator — as a con- 
trollable HWP — plus a polarizing beam splitter to set 
the randomly-selected polarization basis for his measure- 
ment. The functioning of this basis-selection setup is 
unaffected by Alice's photon no longer being in a single 
spatial mode. The reason that we call Fig. 6 a physical 
simulation, rather than a true attack, lies in the measure- 
ment box. Here, Eve has invaded Bob's turf, and inserted 
SWAP gates, half- wave plates, polarizing beam splitters, 
and additional photodetectors, so that she can forward to 
Bob measurement results corresponding to photon count- 
ing on the polarization basis that he has selected while 
she retains the photon counting results corresponding to 
her M-)} measurement. Clearly Bob would never 

knowingly permit Eve to intrude into his receiver box in 



FIG. 6: (Color online) Physical simulation of polarization- 
based BB84 QKD and the FPB-probe attack. 
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FIG. 7: (Color online) Modification of Fig. 6 to accommodate 
Bob's using passive basis selection. 

If Bob employs passive basis selection (Fig. 7), then he 
uses a 50/50 beam splitter followed by static- HWP anal- 
ysis in the H-V and ±45° bases, with only the former 
being explicitly shown in Fig. 7. The rest of Eve's at- 
tack mimics what was seen in Fig. 6, i.e., she gets inside 
Bob's measurement boxes with SWAP gates, half-wave 
plates, and additional detectors so that she can perform 
her probe measurement while providing Bob with his 
BB84 polarization-measurement data. Because the Fig. 7 
arrangement requires that twice as many SWAP gates, 
twice as many half- wave plates, and twice as many single- 
photon detectors be inserted into Bob's receiver system, 
as compared to what is needed in the Fig. 6 setup, we 
shall limit the rest of our discussion to the case of active 
basis selection as it leads to a more parsimonious phys- 
ical simulation of the Fuchs-Peres-Brandt attack. We 
recognize, of course, that the decision to use active basis 
selection is Bob's to make, not Eve's. More importantly, 
however, in Sec. IV we will show how the availability 
of polarization-preserving QND photon- number measure- 
ments can be used to turn Fig. 6 into a true, deterministic 
implementation of the FPB attack. The same conversion 
can be accomplished for passive basis selection. Before 
turning to the true-attack implementation, let us flesh 
out some details of the measurement box in Fig. 6 and 
show how SPDC can be used, in lieu of the single-photon 
source, to perform this physical simulation. 
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Let IV'out) denote the polarization (g) momentum state 
at the output of Eve's P-CNOT gate in Fig. 6. Bob's po- 
larization analysis box splits this state, according to the 
basis he has chosen, so that one basis state goes to the 
upper branch of the measurement box while the other 
goes to the lower branch of that box. This polariza- 
tion sorting does nothing to the momentum qubit, so 
the SWAP gates, half- wave plates, and polarizing beam 
splitters that Eve has inserted into the measurement box 
accomplish her \d-)} projective measurement, i.e., 

the horizontal paths into photodetectors in Fig. 6 are pro- 
jecting the momentum qubit of IV'out) onto \d-) and the 
vertical paths into photodetectors in Fig. 6 are projecting 
this state onto \d+). Eve records the combined results of 
the two \d+) versus \d-) detections, whereas Bob, who 
only sees the combined photodetections for the upper 
and lower branches entering the measurement box, gets 
his BB84 polarization data. Bob's data is impaired, of 
course, by the effect of Eve's P-CNOT. 
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FIG. 8: (Color online) Proposed configuration for a complete 
physical simulation of the FPB attack on BB84 that is based 
on hyperentangied photon pairs from type-II phase matched 
SPDC and gates built from SPTQ quantum logic. 



IV. THE COMPLETE ATTACK 



Single-photon on-demand sources are now under devel- 
opment at several institutions q3 , and their use in BB84 
QKD has been demonstrated |l5| . At present, however, 
it is much more practical to use SPDC as a heralded 
source of single photons 0. In SPDC, signal and idler 
photons are emitted in pairs, thus detection of the signal 
photon heralds the presence of the idler photon. More- 
over, with appropriate configurations SPDC will 
produce photons that are simultaneously entangled in po- 
larization and in momentum. This hyperentanglcmcnt 
leads us to propose the Fig. 8 configuration for physi- 
cally simulating the FPB-probe attack on BB84. Here, 
a pump laser drives SPDC in a type-11 phase matched 
-^(2) crystal, such as periodically-poled potassium titanyl 
phosphate (PPKTP), producing pairs of orthogonally- 
polarized, frequency-degenerate photons that are entan- 
gled in both polarization and momentum. The first po- 
larizing beam splitter transmits a horizontally-polarized 
photon and reflects a vertically-polarized photon while 
preserving their momentum entanglement. Eve uses a 
SWAP gate and (half-wave plate plus polarizing beam 
splitter) polarization rotation so that her photodetector's 
clicking will, by virtue of the momentum entanglement, 
herald the setting of the desired |Tin) momentum-qubit 
state on the horizontally-polarized photon emerging from 
the first polarizing beam splitter. Alice's electronically 
controllable half-wave plate sets the BB84 polarization 
qubit on this photon, and the rest of the Fig. 8 configu- 
ration is identical to that shown and explained in Fig. 6. 
Inasmuch as the SPDC source and SPTQ gates needed to 
realize the Fig. 8 setup have been demonstrated, we pro- 
pose that such an experiment be performed. Simultane- 
ous recording of Alice's polarization choices, Bob's polar- 
ization measurements and Eve's versus results 
can then be processed through the BB84 protocol stack to 
study the degree to which the security proofs and eaves- 
dropping analyses stand up to experimental scrutiny. 



Although the FPB attack's physical simulation, as de- 
scribed in the preceding section, is both experimentally 
feasible and technically informative, any vulnerabilities 
it might reveal would only be of academic interest were 
there no practical means to turn it into a true deter- 
ministic implementation in which Eve did not need to 
invade Bob's receiver. Quantum nondemolition measure- 
ment technology provides the key to creating this com- 
plete attack. As shown in the appendix, it is possible, 
in principle, to use cross-phase modulation between a 
strong coherent-state probe beam and an arbitrarily po- 
larized signal beam to make a QND measurement of the 
signal beam's total photon number while preserving its 
polarization state. Cross-phase modulation QND mea- 
surement of photon number has long been a topic of 
interest in quantum optics and recent theory has 
shown that it provides an excellent new route to pho- 
tonic quantum computation Thus it is not un- 
warranted to presume that polarization-preserving QND 
measurement of total photon number may be developed. 
With such technology in hand, the FPB-probe attack 
shown in Fig. 9 becomes viable. Here, Eve imposes a 
momentum qubit on Alice's polarization-encoded pho- 
ton and performs a P-CNOT operation exactly as dis- 
cussed in conjunction with Figs. 6 and 8. Now, however. 
Eve uses a SWAP-gate half-wave plate combination so 
that the \d+) and momentum qubit states emerg- 
ing from her P-CNOT become \V) and \H) states en- 
tering the polarizing beam splitter that follows the half- 
wave plate. This beam splitter routes these polarizations 
into its transmitted and refiected output ports, respec- 
tively, where, in each arm, Eve employs a SWAP gate, a 
polarization-preserving QND measurement of total pho- 
ton number, and another SWAP gate. The first of these 
SWAPs returns Alice's BB84 qubit to polarization, so 
that a click on Eve's polarization-preserving QND appa- 
ratus completes her measurement without 
further scrambling Alice's BB84 qubit beyond what has 
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already occurred in Eve's P-CNOT gate. The SWAP 
gates that follow the QND boxes then restore definite {V 
and H) polarizations to the light in the upper and lower 
branches so that they may be recombined on a polarizing 
beam splitter. The SWAP gate that follows this recom- 
bination then returns the BB84 qubit riding on Alice's 
photon to polarization for transmission to and measure- 
ment by Bob. This photon is no longer in the single 
spatial mode emitted by Alice's transmitter, hence Bob 
could use spatial-mode discrimination to infer the pres- 
ence of Eve, regardless of the Pe value she had chosen 
to impose. Eve, however, can preclude that possibility. 
Because the result of her {\d+),\d-)} measurement tells 
her the value of the momentum qubit on the photon be- 
ing sent to Bob, she can employ an additional stage of 
qubit rotation to restore this momentum qubit to the \R) 
state corresponding to Alice's transmission. Also, should 
Alice try to defeat Eve's FPB probe by augmenting her 
BB84 polarization qubit with a randomly-chosen momen- 
tum qubit. Eve can use a QND measurement setup like 
that shown in Fig. 9 to collapse the value of that momen- 
tum qubit to \R) or and then rotate that momentum 
qubit into the |i?)-state spatial mode before applying the 
FPB-probe attack. At the conclusion of her attack, she 
can then randomize the momentum qubit on the photon 
that will be routed on to Bob without further impact — 
beyond that imposed by her P-CNOT gate — on that pho- 
ton's polarization qubit. So, unless Alice and Bob gen- 
eralize their polarization-based BB84 protocol to include 
cooperative examination of the momentum qubit, Alice's 
randomization of that qubit will neither affect Eve's FPB 
attack, nor provide Alice and Bob with any additional 
evidence, beyond that obtained from the occurrence of 
errors on sifted bits, of Eve's presence. 
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FIG. 9: (Color online) Deterministic FPB-probe attack on 
polarization-based BB84 that is realized with polarization- 
preserving QND measurements and SPTQ quantum logic. 

Some concluding remarks are now in order. We have 
shown that a physical simulation of the Fuchs-Peres- 
Brandt attack on polarization-based BB84 is feasible 
with currently available technology, and we have argued 
that the development of polarization-preserving QND 
technology for measuring total photon number will per- 



mit mounting of a true deterministic FBP-probe attack. 
Our analysis has presumed ideal conditions in which Al- 
ice employs a single-photon source, there is no propaga- 
tion loss and no extraneous (background) light collec- 
tion, and both Eve and Bob have unity quantum ef- 
ficiency photodetectors with no dark counts. Because 
current QKD systems typically employ attenuated laser 
sources, and suffer from propagation loss, photodetector 
inefficiencies, and extraneous counts, it behooves us to at 
least comment on how such non-idealities could impact 
the FPB probe we have described. 

The use of an attenuated laser source poses no problem 
for the configurations shown in Figs. 6-9. This is because 
the single-qubit rotations and the CNOT gates of SPTQ 
quantum logic effect the same transformations on coher- 
ent states as they do on single-photon states. For ex- 
ample, the same half-wave plate setting that rotates the 
single-photon \H) qubit into the single-photon \ V) qubit 
will transform the horizontally-polarized coherent state 
\a)H into the vertically-polarized coherent state \a)v- 
Likewise, the SPTQ P-CNOT gate that transforms a sin- 
gle photon carrying polarization {\H) ~ |0),|y) = |1)) 
and momentum {\R) = |0), |L) = |1)) qubits according 
to 

chr\HR) + chl\HL) + cvr\VR) + cvl\VL) 

chr\HR) + chl\HL) + cvr\VL) + cyi|l/i?>,(17) 

will transform the four-mode coherent-state input with 
eigenvalues 

[ {o-hr) {aHL! {o-vr) {dvL} ] = 

[ auR otHL avR avL ] , (18) 

into a four-mode coherent-state output with eigenvalues 

[ (aHR) (aHL) {civr) {avL) ] = 

[ aHR aHL avL ayR ] , (19) 

where the a's are annihilation operators for modes la- 
beled by their polarization and beam positions. It follows 
that the coherent-state Pe and Ib calculations mimic 
the qubit derivations that we presented in Sec. Ill, with 
coherent-state inner products taking the place of qubit- 
state inner products. At low average photon number, 
these coherent-state results reduce to the qubit expres- 
sions for events which give rise to clicks in the photode- 
tectors shown in Figs. 6-9. 

Finally, a word about propagation loss, detector inef- 
ficiencies, and extraneous counts from dark current or 
background light is in order. All of these non-idealities 
actually help our Eve, in that they lead to a non-zero 
quantum bit error rate between Alice and Bob in the 
absence of the FPB attack. If Eve's Pe value is set be- 
low that baseline error rate, then her presence should be 
undetectable. 
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APPENDIX: QND MEASUREMENT 

Here we show that it is possible, in principle, to use 
cross-phase modulation between a strong coherent-state 
probe beam and an arbitrarily-polarized signal beam to 
make a QND measurement of the signal beam's total pho- 
ton number. Let {aH,av,ap} be the annihilation oper- 
ators of the horizontal and vertical polarizations of the 
signal beam and the (single-polarization) probe beam, 
respectively at the input to a cross-phase modulation in- 
teraction. We shall take that interaction to transform 
these annihilation operators according to the following 
commutator-preserving unitary operation, 

qh — > a'ff = exp{iKal^ap)aH (^-1) 
ay — > ay = exp{iKa'pap)av (A. 2) 

ap — > d'p = exp[iK{a\jdH + aYav)]o-p, (A. 3) 

where < k ^ 1 is the cross-phase modulation cou- 
pling coefficient. When the probe beam is in a strong 
coherent state, \\/N p) with Np '3> 1/k^, the total pho- 



ton number in the signal beam can be inferred from 
a homodyne-detection measurement of the appropriate 
probe quadrature. In particular, the state of a'p will be 
\^/Np) when the signal beam's total photon number is 
zero, and its state will be |(l -\- iK)\/N p) when the signal 
beam's total photon number is one, where k <C I has been 
employed. Homodyne detection of the d'p2 = Im(ap) 
quadrature thus yields a classical random-variable out- 
come a'p2 that is Gaussian distributed with mean zero 
and variance 1/4, in the absence of a signal-beam photon, 
and Gaussian distributed with mean k\/N p and vari- 
ance 1/4 in the presence of a signal-beam photon. Note 
that these conditional distributions are independent of 
the polarization state of the signal-beam photon when it 
is present. Using the decision rule, "declare signal-beam 
photon present if and only if a'p2 > K'\/iV'p/2," it is easily 
shown that the QND error probability is bounded above 
by exp(-K2Arp/2)/2< 1. 

The preceding polarization independent, low error 
probability QND detection of the signal beam's total 
photon number does not disturb the polarization state 
of that beam. This is so because the probe imposes the 
same nonlinear phase shift on both the H and V polar- 
izations of the signal beam. Hence, if the signal-beam 
input is in the arbitrarily-polarized single-photon state, 

iV's) = ch\1)h\Q)v + cv\Q)h\1)v. (A.4) 

where \ch\'^ + |cyp — 1, then, except for a physically 
unimportant absolute phase, the signal-beam output will 
also be in the state |'0s)- 
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